# SureDash <= 1.12.2 - Authenticated (Subscriber+) Blind Server-Side Request Forgery via Image Source in Community Posts

- **ID:** WPSEC-2026-1426
- **Plugin:** SureDash – Community, Courses & Member Dashboard (`suredash`), https://wordpress.org/plugins/suredash/
- **Affected versions:** all versions before 1.12.3
- **Fixed in:** 1.12.3 (Update to 1.12.3 or later.)
- **Severity:** Medium 6.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N)
- **Weakness:** CWE-918
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-22)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/suredash
- **Fix released:** 2026-10-21
- **Published:** 2026-10-22
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1426/

## Description

The SureDash plugin for WordPress is vulnerable to Blind Server-Side Request Forgery via the image source URL in community post content in all versions up to, and including, 1.12.2, due to the image preview processing calling getimagesize() on the src URL of images that have no height attribute and are not local attachments. This makes it possible for authenticated attackers, with Subscriber-level access and above, to make web requests to arbitrary locations originating from the web application, which can be used to query and probe internal services.

## References

- https://wpsec.com/vuln/WPSEC-2026-1426/
- https://plugins.svn.wordpress.org/suredash/tags/1.12.3/
- https://wordpress.org/plugins/suredash/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1426/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.